Splunk Search

How to extract values from rows that either contain Dept or do not contain Dept?

lctanlc
New Member
2015-05-01 07:33 - [User Login] | Name#ID | 'John#11' | :User name: 'John', ID: '11' successfully logged in
2015-05-02 17:07 - [Search] | Name#ID | 'Sue#222' | :Estimated time | '2,06ms' |, Result count | '23' |, Search Terms | '{"Type":"ALL","Tag":[],"sn":"","searchEndDate":null,"Query":"storm","searchStartDate":1428249600000}' |
2015-08-01 07:33 - [User Login] | Name#ID#Dept | 'Jim#333#ENG1' | :User name: 'Jim', ID: '333' successfully logged in
2015-08-03 09:18 - [Edit] | Name#ID#Dept | 'Tom#3333#ENG2' | :Announcement 'Maintenance' updated successfully.

I have a mixture of rows that contain Name#ID and Name#ID#Dept in a log file. For lines that do not contain Dept, I will have to look up to a CSV file. Otherwise, I will need to extract the Dept from the line.

I only know how to deal with Name#ID or Name#ID#Dept rows separately using the following search queries to extract the Name, ID and Dept:

... | rex "[^\[]*\[(?<Action>[^\]]*)\].*Name#ID \| '(?<Name>[^#]*)#(?<ID>[^']*)" | lookup LKUP.csv ID output Dept
... | rex "[^\[]*\[(?<Action>[^\]]*)\].*Name#ID#Dept \| '(?<Name>[^#]*)#(?<ID>[^']*)#(?<Dept>[^']*)"

Is there anyway to formulate a search query to combine the above-listed queries?

Tags (1)
0 Karma
1 Solution

woodcock
Esteemed Legend

Because lookups do not overwrite fields by default, you can do it like this:

... | rex "[^\[]*\[(?<Action>[^\]]*)\].*Name#ID#Dept \| '(?<Name>[^#]*)#(?<ID>[^']*)(?:#(?<Dept>[^']*))?" | lookup LKUP.csv ID output Dept

View solution in original post

0 Karma

woodcock
Esteemed Legend

Because lookups do not overwrite fields by default, you can do it like this:

... | rex "[^\[]*\[(?<Action>[^\]]*)\].*Name#ID#Dept \| '(?<Name>[^#]*)#(?<ID>[^']*)(?:#(?<Dept>[^']*))?" | lookup LKUP.csv ID output Dept
0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...